Vaultwarden (Bitwarden-compatible) Docker installation, HTTPS configuration, admin panel, organization and collection management, usage with Bitwarden clients.
Vaultwarden is a lightweight, community-supported alternative to the official Bitwarden server, written in Rust. Compared to the official Bitwarden server, it consumes far fewer resources and is fully compatible with all Bitwarden clients (web, desktop, mobile, browser extension). By hosting it on your own server, you retain complete control over your passwords.
Vaultwarden (formerly bitwarden_rs) is an open-source project that reimplements the Bitwarden API in Rust. Key features:
version: '3.8'
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
DOMAIN: "https://vault.example.com"
SIGNUPS_ALLOWED: "true"
ADMIN_TOKEN: "strong-admin-token-here"
WEBSOCKET_ENABLED: "true"
LOG_LEVEL: "warn"
volumes:
- ./vw-data:/data
ports:
- "127.0.0.1:8080:80"
- "127.0.0.1:3012:3012"
# Start the container
docker compose up -d
# Check logs
docker logs vaultwarden -f
Use a strong and random value for ADMIN_TOKEN. You can generate a secure token with openssl rand -base64 48.
# Generate secure admin token
openssl rand -base64 48
# More secure token with Argon2 hash (recommended)
docker run --rm -it vaultwarden/server /vaultwarden hash --preset owasp
Since Vaultwarden requires HTTPS, setting up an Nginx reverse proxy is mandatory.
server {
listen 80;
server_name vault.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name vault.example.com;
ssl_certificate /etc/letsencrypt/live/vault.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/vault.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
client_max_body_size 128M;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /notifications/hub {
proxy_pass http://127.0.0.1:3012;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location /notifications/hub/negotiate {
proxy_pass http://127.0.0.1:8080;
}
}
# Install Certbot
apt install certbot python3-certbot-nginx -y
# Obtain SSL certificate
certbot --nginx -d vault.example.com
# Test automatic renewal
certbot renew --dry-run
Access the admin panel at https://vault.example.com/admin.
# Disable registration after setup
SIGNUPS_ALLOWED=false
# Allow registration only for specific domains
SIGNUPS_DOMAINS_WHITELIST=example.com,company.org
# Invitation system
INVITATIONS_ALLOWED=true
# Email verification
SIGNUPS_VERIFY=true
environment:
SMTP_HOST: "smtp.gmail.com"
SMTP_FROM: "vault@example.com"
SMTP_PORT: "587"
SMTP_SECURITY: "starttls"
SMTP_USERNAME: "vault@example.com"
SMTP_PASSWORD: "app-password"
From the admin panel, go to Users → Invite User to send email invitations.
# Invite user via CLI
docker exec vaultwarden /vaultwarden invite --email user@example.com
Organizations are free in Vaultwarden (paid in official Bitwarden):
https://vault.example.com1. Open the Bitwarden app
2. Tap the region selector on the login screen
3. Select "Self-hosted"
4. Server URL: https://vault.example.com
5. Save and log in
File → Settings → Server URL
https://vault.example.com
# Backup Vaultwarden data
tar -czf vaultwarden-backup-$(date +%Y%m%d).tar.gz ./vw-data/
# Automated backup script
cat > /etc/cron.daily/vaultwarden-backup << 'EOF'
#!/bin/bash
BACKUP_DIR="/backups/vaultwarden"
mkdir -p $BACKUP_DIR
tar -czf $BACKUP_DIR/backup-$(date +%Y%m%d-%H%M%S).tar.gz /opt/vaultwarden/vw-data/
# Delete backups older than 30 days
find $BACKUP_DIR -name "backup-*.tar.gz" -mtime +30 -delete
EOF
chmod +x /etc/cron.daily/vaultwarden-backup
Vaultwarden runs great on REXE VPS servers. 1 GB RAM and 1 vCPU is sufficient for small teams.
Vaultwarden is a community project that reimplements the Bitwarden API in Rust. It consumes far fewer resources than the official Bitwarden server (512 MB RAM is sufficient). Organizations and premium features are free in Vaultwarden, while they are paid in the official server. It is fully compatible with all Bitwarden clients.
No, Bitwarden clients require HTTPS for security reasons. Without a valid SSL certificate, clients will refuse to connect. You can get a free SSL certificate with Let's Encrypt. Self-signed certificates also work for local network use, but you'll need to manually add trust in the clients.
Check that the ADMIN_TOKEN value is correctly defined in docker-compose.yml. If you used an Argon2 hash, '$' characters may need to be escaped in YAML. Wrap the token in single quotes: ADMIN_TOKEN: '$$argon2id$$...'. Restart the container: docker compose restart vaultwarden.
Make sure the /notifications/hub location in your Nginx config is proxied to port 3012. Check that WEBSOCKET_ENABLED=true environment variable is set. Verify that 'proxy_set_header Upgrade $http_upgrade' and 'proxy_set_header Connection upgrade' directives are added in Nginx.
All data is stored in the ./vw-data/ directory. Back up this directory regularly: tar -czf backup.tar.gz ./vw-data/. You can take backups while the container is running for the SQLite database. Critical files: db.sqlite3 (database), rsa_key* (encryption keys), attachments/ (attachments). Losing the keys makes all passwords inaccessible.
Create an organization and add collections. Edit the password you want to share and select the relevant collection in the 'Collections' section. Invite members to the organization and grant collection access permissions. Members can see shared passwords in their own Bitwarden clients.
Coolify installation, Docker and Git integration, application deployment, database management, SSL certificates, environment variables, and self-hosted PaaS alternative to Heroku/Netlify.
Nextcloud installation with Docker, Apache/Nginx configuration, database setup, SSL certificate, file synchronization, app store, and performance optimization.
Portainer CE installation, Docker and Kubernetes management, stack deployment, volume/network management, user authorization, webhook and GitOps integration.